Description

This article explains the coredump file save behavior on the SRX Series.

Solution

Sometimes when there is an issue on SRX, a core-dump file will be generated. You can use the ' show system core-dumps' command to show a list of system core files created.

By default, five core-files per category (process, PFE, FPC, ... ) are saved. If there are already five core files being saved to the file system and another core is being dumped, 
the most recent core file (*.core.4) will be overwritten. 

Example: 

root@srx> show system core-dumps no-forwarding

/var/crash/*core*: No such file or directory
-rw-rw----  1 root  wheel   15402046 Nov 13  2018 /var/tmp/mgd-api.core-tarball.0.tgz
-rw-rw----  1 root  wheel   15389468 Nov 27  2018 /var/tmp/mgd-api.core-tarball.1.tgz
-rw-rw----  1 root  wheel   15401852 Dec 12  2018 /var/tmp/mgd-api.core-tarball.2.tgz
-rw-rw----  1 root  wheel   15407265 Dec 26  2018 /var/tmp/mgd-api.core-tarball.3.tgz
-rw-rw----  1 root  wheel   15541090 Jun 25 07:01 /var/tmp/mgd-api.core-tarball.4.tgz
/var/tmp/pics/*core*: No such file or directory
/var/crash/kernel.*: No such file or directory
/var/jails/rest-api/tmp/*core*: No such file or directory
/tftpboot/corefiles/*core*: No such file or directory
total files: 5

The last coredump file was replaced with new one on Aug 7 in this output. 

root@srx> show system core-dumps no-forwarding

/var/crash/*core*: No such file or directory
-rw-rw----  1 root  wheel   15402046 Nov 13  2018 /var/tmp/mgd-api.core-tarball.0.tgz
-rw-rw----  1 root  wheel   15389468 Nov 27  2018 /var/tmp/mgd-api.core-tarball.1.tgz
-rw-rw----  1 root  wheel   15401852 Dec 12  2018 /var/tmp/mgd-api.core-tarball.2.tgz
-rw-rw----  1 root  wheel   15407265 Dec 26  2018 /var/tmp/mgd-api.core-tarball.3.tgz
-rw-rw----  1 root  wheel   15406949 Aug 7  16:26 /var/tmp/mgd-api.core-tarball.4.tgz
/var/tmp/pics/*core*: No such file or directory
/var/crash/kernel.*: No such file or directory
/var/jails/rest-api/tmp/*core*: No such file or directory
/tftpboot/corefiles/*core*: No such file or directory
total files: 5

Move the core file to the outside of the device using sftp or ftp each time when you find it. Then contact your JTAC representative to investigate it.

To save more core files, use the following command. 

[edit]
root@SRX# set system saved-core-files ?
Possible completions:
  <saved-core-files>   Number of saved core files per executable (1..10)

The range is 1~10, the default value is 5.
 

For more details on saving core files, refer to Saving Core Files from Junos OS Processes

Related Information